Rooted!! Fun box, easy but not immediate. Thank you @Zaitchev for nudges. You’ll think “I’m a fool” when you root it.
There’s my hint:
FOOTHOLD: the conventional standard ways are not the right way. Use your hands 
The CVEs are you’re friends.
USER: just enum everything. EVERYTHING!
ROOT: the basics of privesc. Google ALL, !
PM for hints